Evidence · DiggingBeagle record
Vibe git log invoked repository-configured signature verifier before trust
CVE-2026-122135 relied on Git signature-verification settings during startup.
- Source role
- primary disclosure
Evidence record
CVE-2026-122135 relied on Git signature-verification settings during startup.
Claim-level citations (1)
- supportsMistral Vibe could run a Git signature helper before trust approval: A repository-configured signature program could be invoked by startup git log when signature display was enabled.
Advisory description; log.showSignature, gpg.program and fix 3.0.3